Amendments to the Claims 

1. (Canceled). 

2. (Currently Amended) A method of analyzing a flow for an accounting application, 
comprising: 

capturing an Internet Protocol (IP) IP packet from a network segment to form a captured 
IP packet ; 

determining if the captured IP packet includes a message of a first protocol type for 
providing error reporting, the message having an IP packet that triggered an error event 
embedded within thereby forming an embedded IP packet , the embedded IP packet being of a 
second protocol type and having a flow associated therewith; 

correlating the flow associated with the embedded IP packet to a stored parent flow of a 
given state, thereby associating the error event with the given state of the stored parent flow; and 

using the results of the correlating to provide well-informed accounting information 
related to the flow to the accounting application. 

3. (Original) The method of claim 2, wherein the first protocol type is the Internet Control 
Message Protocol. 

4. (Original) The method of claim 2, wherein the second protocol type is the Transmission 
Control Protocol. 

5. (Original) The method of claim 2, wherein the first protocol type is the Internet Control 
Message Protocol and the second protocol type is the Transmission Control Protocol. 

8. (Previously Amended) The method of claim 6, wherein using comprises: 

reporting a transaction stop indication in response to the change of the given flow state to 
the rejected state. 

9. (Currently Amended) The method of claim 2, wherein correlating further comprises: 
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processing the captured Internet Protocol (IP) IP packet. 



10. (Original) The method of claim 9, wherein the processing comprises: 

using header information to map the flow to a flow stored in a local store. 

1 1 . (Original) The method of claim 10, wherein the header information includes a flow key. 

12. (Original) The method of claim 11, wherein the local store stores for the stored flow, flow 
state information including a flow key associated with metrics and state information, and 
wherein processing further comprises: 

matching the flow key to the flow key of the stored flow. 

13. (Original) The method of claim 12, wherein processing further comprises: 

using the flow to update the metrics and the state information of the stored flow. 

14. (Original) The method of claim 13, wherein processing further comprises: 

providing an accounting record to the accounting application, the accounting record 
reflecting having updated the metrics and the state information of the stored flow. 

15. (Original) The method of claim 11, wherein processing further comprises: 

storing flow state information in association with the flow key for the flow in the local 
store if the header information cannot be used to map the flow to a stored flow. 

Claims 16-18 (Canceled). 

19. (Currently Amended) A computer program product residing on a computer-readable 
medium for analyzing a flow for an accounting application, comprising instructions to cause a 
computer to: 

capture an Internet Protocol (IP) IP packet from a network segment to form a captured IP 

packet ; 



determine if the captured IP packet includes a message of a first protocol type for 
providing error reporting, the message having an embedded IP packet that triggered an error 
event, the embedded IP packet being of a second protocol type and having a flow associated 
therewith; 

correlate the flow associated with the embedded IP packet to a stored parent flow of a 
given state to associate the error event with the given state of the stored parent flow; and 

use results of the correlating to provide well-informed accounting information related to 
the flow to the accounting application. 

20. (Previously Amended) The computer program product of claim 19, wherein the first protocol 
is the Internet Control Message. 

21. (Previously Amended) The method of claim 19, wherein the second protocol type is the 
Transmission Control Protocol. 

22. (Previously Amended) The method of claim 19, wherein the first protocol type is the Internet 
Control Message Protocol and the second protocol type is the Transmission Control Protocol. 

23. (Canceled). 

^^(Currently Amended) A system for flow of network packet data, comprising: 
a processor; 

a memory storing a computer program product residing on a computer-readable medium 
for analyzing a flow for an accounting application, comprising instructions to cause a computer 
to: 

capture an Internet Protocol (IP) IP packet from a network segment; 

determine if the captured IP packet includes a message of the a first protocol type 
for providing error reporting, the message having an embedded IP packet that triggered an error 
event, the embedded IP packet being of the a second protocol type and having a flow associated 
therewith; 
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correlate the flow associated with the embedded IP packet to a stored parent flow 
of a given state to associate the error event with the given state of the stored parent flow; and 

use the results of the correlating to provide well-informed accounting information 
related to the flow to the accounting application. 

25. (Canceled). 

s 

^26. (Previously Amended) The computer program product of claim 24 wherein the first protocol 
is the Internet Control Message. 

y * (Previously Amended) The method of claim 24 wherein the second protocol type is the 

Transmission Control Protocol. 

- n 

2& (Previously Amended) The method of claim 24 wherein the first protocol type is the Internet 
Control Message Protocol and the second protocol type is the Transmission Control Protocol. 
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